Cyber insurance rates keep falling in Canada, but few small firms buy cover
Cyber insurance prices in Canada fell again in the first half of 2026, but most small and medium businesses still do not carry cover, brokers told Insurance Business Canada in a report published Sept. 29.
The disconnect suggests price is not the main obstacle. Brokers said many owners have not linked a cyber incident to the survival of their business.
What the market looks like
Canadian cyber rates fell six per cent in both the first and second quarters of 2026 as new insurers added capacity, according to the report. Derek May of brokerage Hub called it "a race to the bottom over the last couple of years" and said U.S. carriers are already pushing increases of five to 10 per cent, which he expects Canada to follow within 12 to 18 months. Joseph Hines of Gallagher said claims frequency "is certainly not declining."
May put typical small-business cyber premiums at roughly $1,000 to $2,000 a year.
The coverage gap
An Insurance Bureau of Canada-commissioned survey found 22 per cent of SMEs carry cyber insurance and 12 per cent hold a standalone policy. Only 48 per cent of respondents believed their business was vulnerable to an attack. In July, the IBC urged businesses to assess their exposure and pointed them to a free 10-question Cyber Insurance Assessment, Insurance Business reported; its checklist asks whether a business stores customer data online, takes electronic payments or keeps employee records digitally.
"The problem's not affordability, it's that many organizations haven't connected cyber insurance to business survival," Hines said.
Conditions are getting stricter
Cheaper premiums do not mean looser terms. Law firm McCarthy Tétrault noted in May that insurers increasingly require multi-factor authentication, regular backups and staff training as conditions of coverage, and cited a reported case in which a claim by a Canadian organization was denied over a failure to implement MFA.
What to do
- Ask your broker for a cyber quote and read what the policy requires, especially MFA and backup conditions.
- Make sure the controls you declare on the application are actually in place.
- Check whether the policy covers social engineering losses such as payment redirection, which are often limited or excluded.
- Keep the policy document out of shared drives an intruder could reach.
